policy.c 32 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * AppArmor security module
  4. *
  5. * This file contains AppArmor policy manipulation functions
  6. *
  7. * Copyright (C) 1998-2008 Novell/SUSE
  8. * Copyright 2009-2010 Canonical Ltd.
  9. *
  10. * AppArmor policy is based around profiles, which contain the rules a
  11. * task is confined by. Every task in the system has a profile attached
  12. * to it determined either by matching "unconfined" tasks against the
  13. * visible set of profiles or by following a profiles attachment rules.
  14. *
  15. * Each profile exists in a profile namespace which is a container of
  16. * visible profiles. Each namespace contains a special "unconfined" profile,
  17. * which doesn't enforce any confinement on a task beyond DAC.
  18. *
  19. * Namespace and profile names can be written together in either
  20. * of two syntaxes.
  21. * :namespace:profile - used by kernel interfaces for easy detection
  22. * namespace://profile - used by policy
  23. *
  24. * Profile names can not start with : or @ or ^ and may not contain \0
  25. *
  26. * Reserved profile names
  27. * unconfined - special automatically generated unconfined profile
  28. * inherit - special name to indicate profile inheritance
  29. * null-XXXX-YYYY - special automatically generated learning profiles
  30. *
  31. * Namespace names may not start with / or @ and may not contain \0 or :
  32. * Reserved namespace names
  33. * user-XXXX - user defined profiles
  34. *
  35. * a // in a profile or namespace name indicates a hierarchical name with the
  36. * name before the // being the parent and the name after the child.
  37. *
  38. * Profile and namespace hierarchies serve two different but similar purposes.
  39. * The namespace contains the set of visible profiles that are considered
  40. * for attachment. The hierarchy of namespaces allows for virtualizing
  41. * the namespace so that for example a chroot can have its own set of profiles
  42. * which may define some local user namespaces.
  43. * The profile hierarchy severs two distinct purposes,
  44. * - it allows for sub profiles or hats, which allows an application to run
  45. * subprograms under its own profile with different restriction than it
  46. * self, and not have it use the system profile.
  47. * eg. if a mail program starts an editor, the policy might make the
  48. * restrictions tighter on the editor tighter than the mail program,
  49. * and definitely different than general editor restrictions
  50. * - it allows for binary hierarchy of profiles, so that execution history
  51. * is preserved. This feature isn't exploited by AppArmor reference policy
  52. * but is allowed. NOTE: this is currently suboptimal because profile
  53. * aliasing is not currently implemented so that a profile for each
  54. * level must be defined.
  55. * eg. /bin/bash///bin/ls as a name would indicate /bin/ls was started
  56. * from /bin/bash
  57. *
  58. * A profile or namespace name that can contain one or more // separators
  59. * is referred to as an hname (hierarchical).
  60. * eg. /bin/bash//bin/ls
  61. *
  62. * An fqname is a name that may contain both namespace and profile hnames.
  63. * eg. :ns:/bin/bash//bin/ls
  64. *
  65. * NOTES:
  66. * - locking of profile lists is currently fairly coarse. All profile
  67. * lists within a namespace use the namespace lock.
  68. * FIXME: move profile lists to using rcu_lists
  69. */
  70. #include <linux/slab.h>
  71. #include <linux/spinlock.h>
  72. #include <linux/string.h>
  73. #include <linux/cred.h>
  74. #include <linux/rculist.h>
  75. #include <linux/user_namespace.h>
  76. #include "include/apparmor.h"
  77. #include "include/capability.h"
  78. #include "include/cred.h"
  79. #include "include/file.h"
  80. #include "include/ipc.h"
  81. #include "include/match.h"
  82. #include "include/path.h"
  83. #include "include/policy.h"
  84. #include "include/policy_ns.h"
  85. #include "include/policy_unpack.h"
  86. #include "include/resource.h"
  87. int unprivileged_userns_apparmor_policy = 1;
  88. const char *const aa_profile_mode_names[] = {
  89. "enforce",
  90. "complain",
  91. "kill",
  92. "unconfined",
  93. };
  94. /**
  95. * __add_profile - add a profiles to list and label tree
  96. * @list: list to add it to (NOT NULL)
  97. * @profile: the profile to add (NOT NULL)
  98. *
  99. * refcount @profile, should be put by __list_remove_profile
  100. *
  101. * Requires: namespace lock be held, or list not be shared
  102. */
  103. static void __add_profile(struct list_head *list, struct aa_profile *profile)
  104. {
  105. struct aa_label *l;
  106. AA_BUG(!list);
  107. AA_BUG(!profile);
  108. AA_BUG(!profile->ns);
  109. AA_BUG(!mutex_is_locked(&profile->ns->lock));
  110. list_add_rcu(&profile->base.list, list);
  111. /* get list reference */
  112. aa_get_profile(profile);
  113. l = aa_label_insert(&profile->ns->labels, &profile->label);
  114. AA_BUG(l != &profile->label);
  115. aa_put_label(l);
  116. }
  117. /**
  118. * __list_remove_profile - remove a profile from the list it is on
  119. * @profile: the profile to remove (NOT NULL)
  120. *
  121. * remove a profile from the list, warning generally removal should
  122. * be done with __replace_profile as most profile removals are
  123. * replacements to the unconfined profile.
  124. *
  125. * put @profile list refcount
  126. *
  127. * Requires: namespace lock be held, or list not have been live
  128. */
  129. static void __list_remove_profile(struct aa_profile *profile)
  130. {
  131. AA_BUG(!profile);
  132. AA_BUG(!profile->ns);
  133. AA_BUG(!mutex_is_locked(&profile->ns->lock));
  134. list_del_rcu(&profile->base.list);
  135. aa_put_profile(profile);
  136. }
  137. /**
  138. * __remove_profile - remove old profile, and children
  139. * @profile: profile to be replaced (NOT NULL)
  140. *
  141. * Requires: namespace list lock be held, or list not be shared
  142. */
  143. static void __remove_profile(struct aa_profile *profile)
  144. {
  145. AA_BUG(!profile);
  146. AA_BUG(!profile->ns);
  147. AA_BUG(!mutex_is_locked(&profile->ns->lock));
  148. /* release any children lists first */
  149. __aa_profile_list_release(&profile->base.profiles);
  150. /* released by free_profile */
  151. aa_label_remove(&profile->label);
  152. __aafs_profile_rmdir(profile);
  153. __list_remove_profile(profile);
  154. }
  155. /**
  156. * __aa_profile_list_release - remove all profiles on the list and put refs
  157. * @head: list of profiles (NOT NULL)
  158. *
  159. * Requires: namespace lock be held
  160. */
  161. void __aa_profile_list_release(struct list_head *head)
  162. {
  163. struct aa_profile *profile, *tmp;
  164. list_for_each_entry_safe(profile, tmp, head, base.list)
  165. __remove_profile(profile);
  166. }
  167. /**
  168. * aa_free_data - free a data blob
  169. * @ptr: data to free
  170. * @arg: unused
  171. */
  172. static void aa_free_data(void *ptr, void *arg)
  173. {
  174. struct aa_data *data = ptr;
  175. kfree_sensitive(data->data);
  176. kfree_sensitive(data->key);
  177. kfree_sensitive(data);
  178. }
  179. /**
  180. * aa_free_profile - free a profile
  181. * @profile: the profile to free (MAYBE NULL)
  182. *
  183. * Free a profile, its hats and null_profile. All references to the profile,
  184. * its hats and null_profile must have been put.
  185. *
  186. * If the profile was referenced from a task context, free_profile() will
  187. * be called from an rcu callback routine, so we must not sleep here.
  188. */
  189. void aa_free_profile(struct aa_profile *profile)
  190. {
  191. struct rhashtable *rht;
  192. int i;
  193. AA_DEBUG("%s(%p)\n", __func__, profile);
  194. if (!profile)
  195. return;
  196. /* free children profiles */
  197. aa_policy_destroy(&profile->base);
  198. aa_put_profile(rcu_access_pointer(profile->parent));
  199. aa_put_ns(profile->ns);
  200. kfree_sensitive(profile->rename);
  201. aa_free_file_rules(&profile->file);
  202. aa_free_cap_rules(&profile->caps);
  203. aa_free_rlimit_rules(&profile->rlimits);
  204. for (i = 0; i < profile->xattr_count; i++)
  205. kfree_sensitive(profile->xattrs[i]);
  206. kfree_sensitive(profile->xattrs);
  207. for (i = 0; i < profile->secmark_count; i++)
  208. kfree_sensitive(profile->secmark[i].label);
  209. kfree_sensitive(profile->secmark);
  210. kfree_sensitive(profile->dirname);
  211. aa_put_dfa(profile->xmatch);
  212. aa_put_dfa(profile->policy.dfa);
  213. if (profile->data) {
  214. rht = profile->data;
  215. profile->data = NULL;
  216. rhashtable_free_and_destroy(rht, aa_free_data, NULL);
  217. kfree_sensitive(rht);
  218. }
  219. kfree_sensitive(profile->hash);
  220. aa_put_loaddata(profile->rawdata);
  221. aa_label_destroy(&profile->label);
  222. kfree_sensitive(profile);
  223. }
  224. /**
  225. * aa_alloc_profile - allocate, initialize and return a new profile
  226. * @hname: name of the profile (NOT NULL)
  227. * @gfp: allocation type
  228. *
  229. * Returns: refcount profile or NULL on failure
  230. */
  231. struct aa_profile *aa_alloc_profile(const char *hname, struct aa_proxy *proxy,
  232. gfp_t gfp)
  233. {
  234. struct aa_profile *profile;
  235. /* freed by free_profile - usually through aa_put_profile */
  236. profile = kzalloc(sizeof(*profile) + sizeof(struct aa_profile *) * 2,
  237. gfp);
  238. if (!profile)
  239. return NULL;
  240. if (!aa_policy_init(&profile->base, NULL, hname, gfp))
  241. goto fail;
  242. if (!aa_label_init(&profile->label, 1, gfp))
  243. goto fail;
  244. /* update being set needed by fs interface */
  245. if (!proxy) {
  246. proxy = aa_alloc_proxy(&profile->label, gfp);
  247. if (!proxy)
  248. goto fail;
  249. } else
  250. aa_get_proxy(proxy);
  251. profile->label.proxy = proxy;
  252. profile->label.hname = profile->base.hname;
  253. profile->label.flags |= FLAG_PROFILE;
  254. profile->label.vec[0] = profile;
  255. /* refcount released by caller */
  256. return profile;
  257. fail:
  258. aa_free_profile(profile);
  259. return NULL;
  260. }
  261. /* TODO: profile accounting - setup in remove */
  262. /**
  263. * __strn_find_child - find a profile on @head list using substring of @name
  264. * @head: list to search (NOT NULL)
  265. * @name: name of profile (NOT NULL)
  266. * @len: length of @name substring to match
  267. *
  268. * Requires: rcu_read_lock be held
  269. *
  270. * Returns: unrefcounted profile ptr, or NULL if not found
  271. */
  272. static struct aa_profile *__strn_find_child(struct list_head *head,
  273. const char *name, int len)
  274. {
  275. return (struct aa_profile *)__policy_strn_find(head, name, len);
  276. }
  277. /**
  278. * __find_child - find a profile on @head list with a name matching @name
  279. * @head: list to search (NOT NULL)
  280. * @name: name of profile (NOT NULL)
  281. *
  282. * Requires: rcu_read_lock be held
  283. *
  284. * Returns: unrefcounted profile ptr, or NULL if not found
  285. */
  286. static struct aa_profile *__find_child(struct list_head *head, const char *name)
  287. {
  288. return __strn_find_child(head, name, strlen(name));
  289. }
  290. /**
  291. * aa_find_child - find a profile by @name in @parent
  292. * @parent: profile to search (NOT NULL)
  293. * @name: profile name to search for (NOT NULL)
  294. *
  295. * Returns: a refcounted profile or NULL if not found
  296. */
  297. struct aa_profile *aa_find_child(struct aa_profile *parent, const char *name)
  298. {
  299. struct aa_profile *profile;
  300. rcu_read_lock();
  301. do {
  302. profile = __find_child(&parent->base.profiles, name);
  303. } while (profile && !aa_get_profile_not0(profile));
  304. rcu_read_unlock();
  305. /* refcount released by caller */
  306. return profile;
  307. }
  308. /**
  309. * __lookup_parent - lookup the parent of a profile of name @hname
  310. * @ns: namespace to lookup profile in (NOT NULL)
  311. * @hname: hierarchical profile name to find parent of (NOT NULL)
  312. *
  313. * Lookups up the parent of a fully qualified profile name, the profile
  314. * that matches hname does not need to exist, in general this
  315. * is used to load a new profile.
  316. *
  317. * Requires: rcu_read_lock be held
  318. *
  319. * Returns: unrefcounted policy or NULL if not found
  320. */
  321. static struct aa_policy *__lookup_parent(struct aa_ns *ns,
  322. const char *hname)
  323. {
  324. struct aa_policy *policy;
  325. struct aa_profile *profile = NULL;
  326. char *split;
  327. policy = &ns->base;
  328. for (split = strstr(hname, "//"); split;) {
  329. profile = __strn_find_child(&policy->profiles, hname,
  330. split - hname);
  331. if (!profile)
  332. return NULL;
  333. policy = &profile->base;
  334. hname = split + 2;
  335. split = strstr(hname, "//");
  336. }
  337. if (!profile)
  338. return &ns->base;
  339. return &profile->base;
  340. }
  341. /**
  342. * __lookupn_profile - lookup the profile matching @hname
  343. * @base: base list to start looking up profile name from (NOT NULL)
  344. * @hname: hierarchical profile name (NOT NULL)
  345. * @n: length of @hname
  346. *
  347. * Requires: rcu_read_lock be held
  348. *
  349. * Returns: unrefcounted profile pointer or NULL if not found
  350. *
  351. * Do a relative name lookup, recursing through profile tree.
  352. */
  353. static struct aa_profile *__lookupn_profile(struct aa_policy *base,
  354. const char *hname, size_t n)
  355. {
  356. struct aa_profile *profile = NULL;
  357. const char *split;
  358. for (split = strnstr(hname, "//", n); split;
  359. split = strnstr(hname, "//", n)) {
  360. profile = __strn_find_child(&base->profiles, hname,
  361. split - hname);
  362. if (!profile)
  363. return NULL;
  364. base = &profile->base;
  365. n -= split + 2 - hname;
  366. hname = split + 2;
  367. }
  368. if (n)
  369. return __strn_find_child(&base->profiles, hname, n);
  370. return NULL;
  371. }
  372. static struct aa_profile *__lookup_profile(struct aa_policy *base,
  373. const char *hname)
  374. {
  375. return __lookupn_profile(base, hname, strlen(hname));
  376. }
  377. /**
  378. * aa_lookup_profile - find a profile by its full or partial name
  379. * @ns: the namespace to start from (NOT NULL)
  380. * @hname: name to do lookup on. Does not contain namespace prefix (NOT NULL)
  381. * @n: size of @hname
  382. *
  383. * Returns: refcounted profile or NULL if not found
  384. */
  385. struct aa_profile *aa_lookupn_profile(struct aa_ns *ns, const char *hname,
  386. size_t n)
  387. {
  388. struct aa_profile *profile;
  389. rcu_read_lock();
  390. do {
  391. profile = __lookupn_profile(&ns->base, hname, n);
  392. } while (profile && !aa_get_profile_not0(profile));
  393. rcu_read_unlock();
  394. /* the unconfined profile is not in the regular profile list */
  395. if (!profile && strncmp(hname, "unconfined", n) == 0)
  396. profile = aa_get_newest_profile(ns->unconfined);
  397. /* refcount released by caller */
  398. return profile;
  399. }
  400. struct aa_profile *aa_lookup_profile(struct aa_ns *ns, const char *hname)
  401. {
  402. return aa_lookupn_profile(ns, hname, strlen(hname));
  403. }
  404. struct aa_profile *aa_fqlookupn_profile(struct aa_label *base,
  405. const char *fqname, size_t n)
  406. {
  407. struct aa_profile *profile;
  408. struct aa_ns *ns;
  409. const char *name, *ns_name;
  410. size_t ns_len;
  411. name = aa_splitn_fqname(fqname, n, &ns_name, &ns_len);
  412. if (ns_name) {
  413. ns = aa_lookupn_ns(labels_ns(base), ns_name, ns_len);
  414. if (!ns)
  415. return NULL;
  416. } else
  417. ns = aa_get_ns(labels_ns(base));
  418. if (name)
  419. profile = aa_lookupn_profile(ns, name, n - (name - fqname));
  420. else if (ns)
  421. /* default profile for ns, currently unconfined */
  422. profile = aa_get_newest_profile(ns->unconfined);
  423. else
  424. profile = NULL;
  425. aa_put_ns(ns);
  426. return profile;
  427. }
  428. /**
  429. * aa_new_null_profile - create or find a null-X learning profile
  430. * @parent: profile that caused this profile to be created (NOT NULL)
  431. * @hat: true if the null- learning profile is a hat
  432. * @base: name to base the null profile off of
  433. * @gfp: type of allocation
  434. *
  435. * Find/Create a null- complain mode profile used in learning mode. The
  436. * name of the profile is unique and follows the format of parent//null-XXX.
  437. * where XXX is based on the @name or if that fails or is not supplied
  438. * a unique number
  439. *
  440. * null profiles are added to the profile list but the list does not
  441. * hold a count on them so that they are automatically released when
  442. * not in use.
  443. *
  444. * Returns: new refcounted profile else NULL on failure
  445. */
  446. struct aa_profile *aa_new_null_profile(struct aa_profile *parent, bool hat,
  447. const char *base, gfp_t gfp)
  448. {
  449. struct aa_profile *p, *profile;
  450. const char *bname;
  451. char *name = NULL;
  452. AA_BUG(!parent);
  453. if (base) {
  454. name = kmalloc(strlen(parent->base.hname) + 8 + strlen(base),
  455. gfp);
  456. if (name) {
  457. sprintf(name, "%s//null-%s", parent->base.hname, base);
  458. goto name;
  459. }
  460. /* fall through to try shorter uniq */
  461. }
  462. name = kmalloc(strlen(parent->base.hname) + 2 + 7 + 8, gfp);
  463. if (!name)
  464. return NULL;
  465. sprintf(name, "%s//null-%x", parent->base.hname,
  466. atomic_inc_return(&parent->ns->uniq_null));
  467. name:
  468. /* lookup to see if this is a dup creation */
  469. bname = basename(name);
  470. profile = aa_find_child(parent, bname);
  471. if (profile)
  472. goto out;
  473. profile = aa_alloc_profile(name, NULL, gfp);
  474. if (!profile)
  475. goto fail;
  476. profile->mode = APPARMOR_COMPLAIN;
  477. profile->label.flags |= FLAG_NULL;
  478. if (hat)
  479. profile->label.flags |= FLAG_HAT;
  480. profile->path_flags = parent->path_flags;
  481. /* released on free_profile */
  482. rcu_assign_pointer(profile->parent, aa_get_profile(parent));
  483. profile->ns = aa_get_ns(parent->ns);
  484. profile->file.dfa = aa_get_dfa(nulldfa);
  485. profile->policy.dfa = aa_get_dfa(nulldfa);
  486. mutex_lock_nested(&profile->ns->lock, profile->ns->level);
  487. p = __find_child(&parent->base.profiles, bname);
  488. if (p) {
  489. aa_free_profile(profile);
  490. profile = aa_get_profile(p);
  491. } else {
  492. __add_profile(&parent->base.profiles, profile);
  493. }
  494. mutex_unlock(&profile->ns->lock);
  495. /* refcount released by caller */
  496. out:
  497. kfree(name);
  498. return profile;
  499. fail:
  500. kfree(name);
  501. aa_free_profile(profile);
  502. return NULL;
  503. }
  504. /**
  505. * replacement_allowed - test to see if replacement is allowed
  506. * @profile: profile to test if it can be replaced (MAYBE NULL)
  507. * @noreplace: true if replacement shouldn't be allowed but addition is okay
  508. * @info: Returns - info about why replacement failed (NOT NULL)
  509. *
  510. * Returns: %0 if replacement allowed else error code
  511. */
  512. static int replacement_allowed(struct aa_profile *profile, int noreplace,
  513. const char **info)
  514. {
  515. if (profile) {
  516. if (profile->label.flags & FLAG_IMMUTIBLE) {
  517. *info = "cannot replace immutable profile";
  518. return -EPERM;
  519. } else if (noreplace) {
  520. *info = "profile already exists";
  521. return -EEXIST;
  522. }
  523. }
  524. return 0;
  525. }
  526. /* audit callback for net specific fields */
  527. static void audit_cb(struct audit_buffer *ab, void *va)
  528. {
  529. struct common_audit_data *sa = va;
  530. if (aad(sa)->iface.ns) {
  531. audit_log_format(ab, " ns=");
  532. audit_log_untrustedstring(ab, aad(sa)->iface.ns);
  533. }
  534. }
  535. /**
  536. * audit_policy - Do auditing of policy changes
  537. * @label: label to check if it can manage policy
  538. * @op: policy operation being performed
  539. * @ns_name: name of namespace being manipulated
  540. * @name: name of profile being manipulated (NOT NULL)
  541. * @info: any extra information to be audited (MAYBE NULL)
  542. * @error: error code
  543. *
  544. * Returns: the error to be returned after audit is done
  545. */
  546. static int audit_policy(struct aa_label *label, const char *op,
  547. const char *ns_name, const char *name,
  548. const char *info, int error)
  549. {
  550. DEFINE_AUDIT_DATA(sa, LSM_AUDIT_DATA_NONE, op);
  551. aad(&sa)->iface.ns = ns_name;
  552. aad(&sa)->name = name;
  553. aad(&sa)->info = info;
  554. aad(&sa)->error = error;
  555. aad(&sa)->label = label;
  556. aa_audit_msg(AUDIT_APPARMOR_STATUS, &sa, audit_cb);
  557. return error;
  558. }
  559. /**
  560. * policy_view_capable - check if viewing policy in at @ns is allowed
  561. * ns: namespace being viewed by current task (may be NULL)
  562. * Returns: true if viewing policy is allowed
  563. *
  564. * If @ns is NULL then the namespace being viewed is assumed to be the
  565. * tasks current namespace.
  566. */
  567. bool policy_view_capable(struct aa_ns *ns)
  568. {
  569. struct user_namespace *user_ns = current_user_ns();
  570. struct aa_ns *view_ns = aa_get_current_ns();
  571. bool root_in_user_ns = uid_eq(current_euid(), make_kuid(user_ns, 0)) ||
  572. in_egroup_p(make_kgid(user_ns, 0));
  573. bool response = false;
  574. if (!ns)
  575. ns = view_ns;
  576. if (root_in_user_ns && aa_ns_visible(view_ns, ns, true) &&
  577. (user_ns == &init_user_ns ||
  578. (unprivileged_userns_apparmor_policy != 0 &&
  579. user_ns->level == view_ns->level)))
  580. response = true;
  581. aa_put_ns(view_ns);
  582. return response;
  583. }
  584. bool policy_admin_capable(struct aa_ns *ns)
  585. {
  586. struct user_namespace *user_ns = current_user_ns();
  587. bool capable = ns_capable(user_ns, CAP_MAC_ADMIN);
  588. AA_DEBUG("cap_mac_admin? %d\n", capable);
  589. AA_DEBUG("policy locked? %d\n", aa_g_lock_policy);
  590. return policy_view_capable(ns) && capable && !aa_g_lock_policy;
  591. }
  592. /**
  593. * aa_may_manage_policy - can the current task manage policy
  594. * @label: label to check if it can manage policy
  595. * @op: the policy manipulation operation being done
  596. *
  597. * Returns: 0 if the task is allowed to manipulate policy else error
  598. */
  599. int aa_may_manage_policy(struct aa_label *label, struct aa_ns *ns, u32 mask)
  600. {
  601. const char *op;
  602. if (mask & AA_MAY_REMOVE_POLICY)
  603. op = OP_PROF_RM;
  604. else if (mask & AA_MAY_REPLACE_POLICY)
  605. op = OP_PROF_REPL;
  606. else
  607. op = OP_PROF_LOAD;
  608. /* check if loading policy is locked out */
  609. if (aa_g_lock_policy)
  610. return audit_policy(label, op, NULL, NULL, "policy_locked",
  611. -EACCES);
  612. if (!policy_admin_capable(ns))
  613. return audit_policy(label, op, NULL, NULL, "not policy admin",
  614. -EACCES);
  615. /* TODO: add fine grained mediation of policy loads */
  616. return 0;
  617. }
  618. static struct aa_profile *__list_lookup_parent(struct list_head *lh,
  619. struct aa_profile *profile)
  620. {
  621. const char *base = basename(profile->base.hname);
  622. long len = base - profile->base.hname;
  623. struct aa_load_ent *ent;
  624. /* parent won't have trailing // so remove from len */
  625. if (len <= 2)
  626. return NULL;
  627. len -= 2;
  628. list_for_each_entry(ent, lh, list) {
  629. if (ent->new == profile)
  630. continue;
  631. if (strncmp(ent->new->base.hname, profile->base.hname, len) ==
  632. 0 && ent->new->base.hname[len] == 0)
  633. return ent->new;
  634. }
  635. return NULL;
  636. }
  637. /**
  638. * __replace_profile - replace @old with @new on a list
  639. * @old: profile to be replaced (NOT NULL)
  640. * @new: profile to replace @old with (NOT NULL)
  641. * @share_proxy: transfer @old->proxy to @new
  642. *
  643. * Will duplicate and refcount elements that @new inherits from @old
  644. * and will inherit @old children.
  645. *
  646. * refcount @new for list, put @old list refcount
  647. *
  648. * Requires: namespace list lock be held, or list not be shared
  649. */
  650. static void __replace_profile(struct aa_profile *old, struct aa_profile *new)
  651. {
  652. struct aa_profile *child, *tmp;
  653. if (!list_empty(&old->base.profiles)) {
  654. LIST_HEAD(lh);
  655. list_splice_init_rcu(&old->base.profiles, &lh, synchronize_rcu);
  656. list_for_each_entry_safe(child, tmp, &lh, base.list) {
  657. struct aa_profile *p;
  658. list_del_init(&child->base.list);
  659. p = __find_child(&new->base.profiles, child->base.name);
  660. if (p) {
  661. /* @p replaces @child */
  662. __replace_profile(child, p);
  663. continue;
  664. }
  665. /* inherit @child and its children */
  666. /* TODO: update hname of inherited children */
  667. /* list refcount transferred to @new */
  668. p = aa_deref_parent(child);
  669. rcu_assign_pointer(child->parent, aa_get_profile(new));
  670. list_add_rcu(&child->base.list, &new->base.profiles);
  671. aa_put_profile(p);
  672. }
  673. }
  674. if (!rcu_access_pointer(new->parent)) {
  675. struct aa_profile *parent = aa_deref_parent(old);
  676. rcu_assign_pointer(new->parent, aa_get_profile(parent));
  677. }
  678. aa_label_replace(&old->label, &new->label);
  679. /* migrate dents must come after label replacement b/c update */
  680. __aafs_profile_migrate_dents(old, new);
  681. if (list_empty(&new->base.list)) {
  682. /* new is not on a list already */
  683. list_replace_rcu(&old->base.list, &new->base.list);
  684. aa_get_profile(new);
  685. aa_put_profile(old);
  686. } else
  687. __list_remove_profile(old);
  688. }
  689. /**
  690. * __lookup_replace - lookup replacement information for a profile
  691. * @ns - namespace the lookup occurs in
  692. * @hname - name of profile to lookup
  693. * @noreplace - true if not replacing an existing profile
  694. * @p - Returns: profile to be replaced
  695. * @info - Returns: info string on why lookup failed
  696. *
  697. * Returns: profile to replace (no ref) on success else ptr error
  698. */
  699. static int __lookup_replace(struct aa_ns *ns, const char *hname,
  700. bool noreplace, struct aa_profile **p,
  701. const char **info)
  702. {
  703. *p = aa_get_profile(__lookup_profile(&ns->base, hname));
  704. if (*p) {
  705. int error = replacement_allowed(*p, noreplace, info);
  706. if (error) {
  707. *info = "profile can not be replaced";
  708. return error;
  709. }
  710. }
  711. return 0;
  712. }
  713. static void share_name(struct aa_profile *old, struct aa_profile *new)
  714. {
  715. aa_put_str(new->base.hname);
  716. aa_get_str(old->base.hname);
  717. new->base.hname = old->base.hname;
  718. new->base.name = old->base.name;
  719. new->label.hname = old->label.hname;
  720. }
  721. /* Update to newest version of parent after previous replacements
  722. * Returns: unrefcount newest version of parent
  723. */
  724. static struct aa_profile *update_to_newest_parent(struct aa_profile *new)
  725. {
  726. struct aa_profile *parent, *newest;
  727. parent = rcu_dereference_protected(new->parent,
  728. mutex_is_locked(&new->ns->lock));
  729. newest = aa_get_newest_profile(parent);
  730. /* parent replaced in this atomic set? */
  731. if (newest != parent) {
  732. aa_put_profile(parent);
  733. rcu_assign_pointer(new->parent, newest);
  734. } else
  735. aa_put_profile(newest);
  736. return newest;
  737. }
  738. /**
  739. * aa_replace_profiles - replace profile(s) on the profile list
  740. * @policy_ns: namespace load is occurring on
  741. * @label: label that is attempting to load/replace policy
  742. * @mask: permission mask
  743. * @udata: serialized data stream (NOT NULL)
  744. *
  745. * unpack and replace a profile on the profile list and uses of that profile
  746. * by any task creds via invalidating the old version of the profile, which
  747. * tasks will notice to update their own cred. If the profile does not exist
  748. * on the profile list it is added.
  749. *
  750. * Returns: size of data consumed else error code on failure.
  751. */
  752. ssize_t aa_replace_profiles(struct aa_ns *policy_ns, struct aa_label *label,
  753. u32 mask, struct aa_loaddata *udata)
  754. {
  755. const char *ns_name = NULL, *info = NULL;
  756. struct aa_ns *ns = NULL;
  757. struct aa_load_ent *ent, *tmp;
  758. struct aa_loaddata *rawdata_ent;
  759. const char *op;
  760. ssize_t count, error;
  761. LIST_HEAD(lh);
  762. op = mask & AA_MAY_REPLACE_POLICY ? OP_PROF_REPL : OP_PROF_LOAD;
  763. aa_get_loaddata(udata);
  764. /* released below */
  765. error = aa_unpack(udata, &lh, &ns_name);
  766. if (error)
  767. goto out;
  768. /* ensure that profiles are all for the same ns
  769. * TODO: update locking to remove this constaint. All profiles in
  770. * the load set must succeed as a set or the load will
  771. * fail. Sort ent list and take ns locks in hierarchy order
  772. */
  773. count = 0;
  774. list_for_each_entry(ent, &lh, list) {
  775. if (ns_name) {
  776. if (ent->ns_name &&
  777. strcmp(ent->ns_name, ns_name) != 0) {
  778. info = "policy load has mixed namespaces";
  779. error = -EACCES;
  780. goto fail;
  781. }
  782. } else if (ent->ns_name) {
  783. if (count) {
  784. info = "policy load has mixed namespaces";
  785. error = -EACCES;
  786. goto fail;
  787. }
  788. ns_name = ent->ns_name;
  789. } else
  790. count++;
  791. }
  792. if (ns_name) {
  793. ns = aa_prepare_ns(policy_ns ? policy_ns : labels_ns(label),
  794. ns_name);
  795. if (IS_ERR(ns)) {
  796. op = OP_PROF_LOAD;
  797. info = "failed to prepare namespace";
  798. error = PTR_ERR(ns);
  799. ns = NULL;
  800. ent = NULL;
  801. goto fail;
  802. }
  803. } else
  804. ns = aa_get_ns(policy_ns ? policy_ns : labels_ns(label));
  805. mutex_lock_nested(&ns->lock, ns->level);
  806. /* check for duplicate rawdata blobs: space and file dedup */
  807. list_for_each_entry(rawdata_ent, &ns->rawdata_list, list) {
  808. if (aa_rawdata_eq(rawdata_ent, udata)) {
  809. struct aa_loaddata *tmp;
  810. tmp = __aa_get_loaddata(rawdata_ent);
  811. /* check we didn't fail the race */
  812. if (tmp) {
  813. aa_put_loaddata(udata);
  814. udata = tmp;
  815. break;
  816. }
  817. }
  818. }
  819. /* setup parent and ns info */
  820. list_for_each_entry(ent, &lh, list) {
  821. struct aa_policy *policy;
  822. ent->new->rawdata = aa_get_loaddata(udata);
  823. error = __lookup_replace(ns, ent->new->base.hname,
  824. !(mask & AA_MAY_REPLACE_POLICY),
  825. &ent->old, &info);
  826. if (error)
  827. goto fail_lock;
  828. if (ent->new->rename) {
  829. error = __lookup_replace(ns, ent->new->rename,
  830. !(mask & AA_MAY_REPLACE_POLICY),
  831. &ent->rename, &info);
  832. if (error)
  833. goto fail_lock;
  834. }
  835. /* released when @new is freed */
  836. ent->new->ns = aa_get_ns(ns);
  837. if (ent->old || ent->rename)
  838. continue;
  839. /* no ref on policy only use inside lock */
  840. policy = __lookup_parent(ns, ent->new->base.hname);
  841. if (!policy) {
  842. struct aa_profile *p;
  843. p = __list_lookup_parent(&lh, ent->new);
  844. if (!p) {
  845. error = -ENOENT;
  846. info = "parent does not exist";
  847. goto fail_lock;
  848. }
  849. rcu_assign_pointer(ent->new->parent, aa_get_profile(p));
  850. } else if (policy != &ns->base) {
  851. /* released on profile replacement or free_profile */
  852. struct aa_profile *p = (struct aa_profile *) policy;
  853. rcu_assign_pointer(ent->new->parent, aa_get_profile(p));
  854. }
  855. }
  856. /* create new fs entries for introspection if needed */
  857. if (!udata->dents[AAFS_LOADDATA_DIR]) {
  858. error = __aa_fs_create_rawdata(ns, udata);
  859. if (error) {
  860. info = "failed to create raw_data dir and files";
  861. ent = NULL;
  862. goto fail_lock;
  863. }
  864. }
  865. list_for_each_entry(ent, &lh, list) {
  866. if (!ent->old) {
  867. struct dentry *parent;
  868. if (rcu_access_pointer(ent->new->parent)) {
  869. struct aa_profile *p;
  870. p = aa_deref_parent(ent->new);
  871. parent = prof_child_dir(p);
  872. } else
  873. parent = ns_subprofs_dir(ent->new->ns);
  874. error = __aafs_profile_mkdir(ent->new, parent);
  875. }
  876. if (error) {
  877. info = "failed to create";
  878. goto fail_lock;
  879. }
  880. }
  881. /* Done with checks that may fail - do actual replacement */
  882. __aa_bump_ns_revision(ns);
  883. __aa_loaddata_update(udata, ns->revision);
  884. list_for_each_entry_safe(ent, tmp, &lh, list) {
  885. list_del_init(&ent->list);
  886. op = (!ent->old && !ent->rename) ? OP_PROF_LOAD : OP_PROF_REPL;
  887. if (ent->old && ent->old->rawdata == ent->new->rawdata) {
  888. /* dedup actual profile replacement */
  889. audit_policy(label, op, ns_name, ent->new->base.hname,
  890. "same as current profile, skipping",
  891. error);
  892. /* break refcount cycle with proxy. */
  893. aa_put_proxy(ent->new->label.proxy);
  894. ent->new->label.proxy = NULL;
  895. goto skip;
  896. }
  897. /*
  898. * TODO: finer dedup based on profile range in data. Load set
  899. * can differ but profile may remain unchanged
  900. */
  901. audit_policy(label, op, ns_name, ent->new->base.hname, NULL,
  902. error);
  903. if (ent->old) {
  904. share_name(ent->old, ent->new);
  905. __replace_profile(ent->old, ent->new);
  906. } else {
  907. struct list_head *lh;
  908. if (rcu_access_pointer(ent->new->parent)) {
  909. struct aa_profile *parent;
  910. parent = update_to_newest_parent(ent->new);
  911. lh = &parent->base.profiles;
  912. } else
  913. lh = &ns->base.profiles;
  914. __add_profile(lh, ent->new);
  915. }
  916. skip:
  917. aa_load_ent_free(ent);
  918. }
  919. __aa_labelset_update_subtree(ns);
  920. mutex_unlock(&ns->lock);
  921. out:
  922. aa_put_ns(ns);
  923. aa_put_loaddata(udata);
  924. kfree(ns_name);
  925. if (error)
  926. return error;
  927. return udata->size;
  928. fail_lock:
  929. mutex_unlock(&ns->lock);
  930. /* audit cause of failure */
  931. op = (ent && !ent->old) ? OP_PROF_LOAD : OP_PROF_REPL;
  932. fail:
  933. audit_policy(label, op, ns_name, ent ? ent->new->base.hname : NULL,
  934. info, error);
  935. /* audit status that rest of profiles in the atomic set failed too */
  936. info = "valid profile in failed atomic policy load";
  937. list_for_each_entry(tmp, &lh, list) {
  938. if (tmp == ent) {
  939. info = "unchecked profile in failed atomic policy load";
  940. /* skip entry that caused failure */
  941. continue;
  942. }
  943. op = (!tmp->old) ? OP_PROF_LOAD : OP_PROF_REPL;
  944. audit_policy(label, op, ns_name, tmp->new->base.hname, info,
  945. error);
  946. }
  947. list_for_each_entry_safe(ent, tmp, &lh, list) {
  948. list_del_init(&ent->list);
  949. aa_load_ent_free(ent);
  950. }
  951. goto out;
  952. }
  953. /**
  954. * aa_remove_profiles - remove profile(s) from the system
  955. * @policy_ns: namespace the remove is being done from
  956. * @subj: label attempting to remove policy
  957. * @fqname: name of the profile or namespace to remove (NOT NULL)
  958. * @size: size of the name
  959. *
  960. * Remove a profile or sub namespace from the current namespace, so that
  961. * they can not be found anymore and mark them as replaced by unconfined
  962. *
  963. * NOTE: removing confinement does not restore rlimits to preconfinement values
  964. *
  965. * Returns: size of data consume else error code if fails
  966. */
  967. ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj,
  968. char *fqname, size_t size)
  969. {
  970. struct aa_ns *ns = NULL;
  971. struct aa_profile *profile = NULL;
  972. const char *name = fqname, *info = NULL;
  973. const char *ns_name = NULL;
  974. ssize_t error = 0;
  975. if (*fqname == 0) {
  976. info = "no profile specified";
  977. error = -ENOENT;
  978. goto fail;
  979. }
  980. if (fqname[0] == ':') {
  981. size_t ns_len;
  982. name = aa_splitn_fqname(fqname, size, &ns_name, &ns_len);
  983. /* released below */
  984. ns = aa_lookupn_ns(policy_ns ? policy_ns : labels_ns(subj),
  985. ns_name, ns_len);
  986. if (!ns) {
  987. info = "namespace does not exist";
  988. error = -ENOENT;
  989. goto fail;
  990. }
  991. } else
  992. /* released below */
  993. ns = aa_get_ns(policy_ns ? policy_ns : labels_ns(subj));
  994. if (!name) {
  995. /* remove namespace - can only happen if fqname[0] == ':' */
  996. mutex_lock_nested(&ns->parent->lock, ns->level);
  997. __aa_bump_ns_revision(ns);
  998. __aa_remove_ns(ns);
  999. mutex_unlock(&ns->parent->lock);
  1000. } else {
  1001. /* remove profile */
  1002. mutex_lock_nested(&ns->lock, ns->level);
  1003. profile = aa_get_profile(__lookup_profile(&ns->base, name));
  1004. if (!profile) {
  1005. error = -ENOENT;
  1006. info = "profile does not exist";
  1007. goto fail_ns_lock;
  1008. }
  1009. name = profile->base.hname;
  1010. __aa_bump_ns_revision(ns);
  1011. __remove_profile(profile);
  1012. __aa_labelset_update_subtree(ns);
  1013. mutex_unlock(&ns->lock);
  1014. }
  1015. /* don't fail removal if audit fails */
  1016. (void) audit_policy(subj, OP_PROF_RM, ns_name, name, info,
  1017. error);
  1018. aa_put_ns(ns);
  1019. aa_put_profile(profile);
  1020. return size;
  1021. fail_ns_lock:
  1022. mutex_unlock(&ns->lock);
  1023. aa_put_ns(ns);
  1024. fail:
  1025. (void) audit_policy(subj, OP_PROF_RM, ns_name, name, info,
  1026. error);
  1027. return error;
  1028. }